Privacy Policy

The short version: we collect what we need to run mwahhh: your account, your conversations (so characters can remember you), purchases, basic analytics, and ad measurement with Meta that never includes your chats. We don't sell your data, we don't use your chats for ads, and you can delete everything whenever you want.

1. Who we are

This Privacy Policy explains how mwahhh ("we", "us") processes personal data when you use the mwahhh app and mwahhh.com (the "Service"). We are the data controller for this processing. Contact: [email protected].

2. What we collect

Account data

Email address and authentication identifiers (including your Apple or Google account identifier if you sign in with them). Authentication is handled by our provider Supabase.
Profile and onboarding choices: display name, who you're interested in, connection mode, content preferences.
Your confirmation that you are 18 or older.

Conversation data

Messages you exchange with characters, your date-storyline choices, and derived "memory" the Service creates so characters can stay consistent (e.g. facts you've shared, relationship progress).

Purchase data

Subscription status, purchase history and virtual-currency balance. Payments are processed by the app store (Apple App Store or Google Play); we never see or store your card details.

Usage & device data

Product analytics events (screens viewed, features used), approximate device information and app version — collected via PostHog, hosted in the EU.
Crash and error reports (via Sentry) to keep the app working.
On Android, the Google Play install referrer: the campaign or link that led to your install, so we know which channels bring people to mwahhh.

Advertising measurement data

The app includes Meta's SDK, which records app installs and opens, sign-up, viewing the VIP offer, starting a checkout, and purchases, subscriptions and free-trial starts (the product and its price, never your chats or anything you create). These events go to Meta with an install-specific anonymous ID, basic device information (model, OS version, app version, language, time zone, screen size) and, where allowed, your device's advertising identifier: on iOS only if you allow tracking when the app asks, on Android the Google advertising ID unless you have deleted or reset it in your device settings.
Our server also reports store-confirmed subscription renewals to Meta with the same identifiers, because the app itself does not see them.

We do not knowingly collect data from anyone under 18, and we do not collect precise location data.

3. How we use your data

To run the Service: operate your account, generate character replies, keep conversation memory, deliver voice notes and photos, and process purchases.
AI processing: to generate character content, relevant parts of your conversations are processed by our AI infrastructure providers (currently OpenAI for text, ElevenLabs for voice, and fal.ai for images). They process this data on our behalf to provide the Service.
Safety & moderation: automated and manual review to enforce our Content Guidelines and the law.
To improve mwahhh: aggregated, pseudonymised analytics on how features are used.
Advertising measurement: to learn which of our ads bring people to mwahhh and which of them lead to purchases, and to let Meta optimise our ad campaigns. We do not show ads inside the app.
To communicate: service messages about your account, purchases or policy changes.

We do not sell personal data, and we do not use the content of your conversations for third-party advertising.

4. Legal bases (EU/EEA/UK)

Contract: providing the Service you signed up for (account, chat, memory, purchases).
Legitimate interests: safety, moderation, fraud prevention, service analytics and improvement, and measuring our advertising.
Consent: where required (e.g. optional notifications, and on iOS the tracking permission for your advertising identifier); you can withdraw consent anytime.
Legal obligation: where we must retain or disclose data by law.

5. Who we share data with

Service providers ("processors") that help us run mwahhh, under contracts that restrict how they use your data:

Supabase: authentication, database and file storage
DigitalOcean: application hosting (EU region)
OpenAI: text generation for character replies
ElevenLabs: character voice generation
fal.ai: character image generation
PostHog (EU): product analytics
Sentry: crash and error reporting

For advertising measurement, Meta Platforms (Meta Platforms Ireland Ltd. for people in the EU, EEA and UK; Meta Platforms, Inc. elsewhere) receives the advertising measurement data described in section 2, under Meta's Business Tools Terms. Meta also uses it for its own purposes as described in its privacy policy. We never share your conversations or anything you create with Meta.

We may also disclose data if required by law, or as part of a merger or acquisition (we'd notify you first).

6. International transfers

We keep primary hosting and analytics in the EU. Some providers (for example AI-generation providers and Meta) may process data in the United States; where that happens we rely on safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

7. How long we keep data

Account, profile and conversation data: for as long as your account exists.
After you delete your account: personal data is deleted or irreversibly anonymised within 30 days, except records we must keep for legal, tax or fraud-prevention reasons.
Analytics and crash data: retained in aggregate or pseudonymised form.
The advertising identifiers we store are deleted when you delete your account. Data already sent to Meta is kept under Meta's own retention rules.

8. Your rights

Depending on where you live (including under the GDPR), you have the right to access, correct, delete and export your personal data, to object to or restrict certain processing, and to withdraw consent. You can:

delete your account and data directly in the app — see how to delete your account;
stop advertising tracking: on iOS, choose "Ask App Not to Track" when the app asks, or turn it off later in Settings > Privacy & Security > Tracking; on Android, delete or reset your advertising ID in your device's Settings (Privacy > Ads, or Google > Ads);
email [email protected] for any other request — we respond within 30 days;
complain to your local data-protection authority if you're unhappy with our answer.

9. Security

We use industry-standard measures to protect your data: encryption in transit, encrypted storage, access controls, and isolation between users' conversations. No system is 100% secure, but we design for privacy from the start.

10. Children

mwahhh is strictly for adults (18+). We do not knowingly process data of anyone under 18; if we learn we have, we delete the account and its data.

11. Changes

We'll update this policy as the Service evolves. If changes are material we'll notify you in the app or by email before they take effect. The "last updated" date at the top always tells you the current version.

12. Contact

Privacy questions or requests: [email protected].